c2d842c9e178ed5df5f500078526de4b95fcc6cc22fbc9ee22777b7e1f9a798e | Triage

Analysis

max time kernel
129s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 13:09

Sharing

Report Analysis Logs

General

Target

95ef79a4f339dca7f6469d766af95090_NEAS.dll
Size

1.6MB
MD5

95ef79a4f339dca7f6469d766af95090
SHA1

fabc82508f367723671dceb966a8757e01a105e7
SHA256

c2d842c9e178ed5df5f500078526de4b95fcc6cc22fbc9ee22777b7e1f9a798e
SHA512

4a4224f59159c25f7944923fca6fb9fa719409f38a5cee682e1c22488ddc481abdce9da9fa36ce5eb2c85dbf9cf7e4933d2df4143c50d71ec37bb2c572aefdb7
SSDEEP

49152:+tYEyrJEiwNPWVU8T+plIksK/LW5msAkL79nQ:pdrL4PWVUnplz

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 4856	1440	rundll32.exe	85
PID 1440 wrote to memory of 4856	1440	rundll32.exe	85
PID 1440 wrote to memory of 4856	1440	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95ef79a4f339dca7f6469d766af95090_NEAS.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\95ef79a4f339dca7f6469d766af95090_NEAS.dll,#1
  2⤵
  PID:4856

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads